by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This package appears to implement what it claims (formatting .docx documents) and doesn't request secrets or network access, but it contains several practical issues you should address before running it:
- Do NOT run install.sh unreviewed. It uses an unknown 'uv' command. Replace with standard commands (for example: python3 -m venv .venv && source .venv/bin/activate && pip install python-docx) or inspect what 'uv' would do on your system.
- quick_api.py will fail as written: it imports 'docx_f...详细分析 ▾
ℹ 用途与能力
The name, description, and primary code (docx-formatter.py) are consistent: the script uses python-docx to produce Chinese government-style .docx documents and implements quote conversion, headings, pagination, and formatting. There are no unexpected credentials or network calls, so the requested resources are proportionate to the stated purpose.
⚠ 指令范围
SKILL.md instructs running install.sh and provides CLI usage consistent with the code, but the documentation also declares automatic trigger keywords for sensitive government/party documents (e.g., "民主生活会","述职"). The runtime instructions do not ask for unrelated system files or credentials. However, SKILL.md examples and usage examples are inconsistent with the code (see details below), which could cause the agent or user to run failing or unexpected commands.
⚠ 安装机制
There is no registry install spec (instruction-only), but an included install.sh is present. install.sh uses a nonstandard command 'uv' (calls 'uv venv' and 'uv pip install python-docx') which is not a typical system tool and will likely fail or execute an unexpected program if 'uv' exists on the host. The installer is therefore brittle and potentially dangerous to run without review; it should be replaced with a standard venv/pip invocation.
✓ 凭证需求
The skill declares no required environment variables, no credentials, and no system config paths. The code does not access environment variables or secrets. This is proportionate to the skill's functionality.
✓ 持久化与权限
The skill does not request always:true, does not modify other skills, and has no installation behavior that attempts to persist credentials or modify global agent settings. It is user-invocable only (default).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/3
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install docx-formatter
镜像加速npx clawhub@latest install docx-formatter --registry https://cn.longxiaskill.com